Skip to content

[FEATURE] Add Local Registry Fallback For Machine Running SharpHound #248

@CravateRouge

Description

@CravateRouge

Currently, SharpHound always uses RegistryKey.OpenRemoteBaseKey to read registry values

var remoteKey = await _adaptiveTimeout.ExecuteWithTimeout((_) => RegistryKey.OpenRemoteBaseKey(hive, machineName));

However, there are scenarios where a standard user runs SharpHound directly on a Domain Controller or another target machine. In these cases, the call to OpenRemoteBaseKey often fails because it requires the Remote Registry service and appropriate remote permissions, which standard users typically lack.
On the other hand, the same user may have sufficient rights to read the local registry. Therefore, adding a check to determine if machineName refers to the local machine and using RegistryKey.OpenBaseKey instead would significantly improve data collection success rates.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions